• J. Bruce Fields's avatar
    nfsd4: zero op arguments beyond the 8th compound op · 5d6031ca
    J. Bruce Fields authored
    The first 8 ops of the compound are zeroed since they're a part of the
    argument that's zeroed by the
    
    	memset(rqstp->rq_argp, 0, procp->pc_argsize);
    
    in svc_process_common().  But we handle larger compounds by allocating
    the memory on the fly in nfsd4_decode_compound().  Other than code
    recently fixed by 01529e3f "NFSD: Fix memory leak in encoding denied
    lock", I don't know of any examples of code depending on this
    initialization. But it definitely seems possible, and I'd rather be
    safe.
    
    Compounds this long are unusual so I'm much more worried about failure
    in this poorly tested cases than about an insignificant performance hit.
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    5d6031ca
nfs4xdr.c 101 KB